Apache Axis 1.x unauthenticated remote class instantiation via SOAP (CVE-2026-90436)
Deserialization of inbound SOAP faults in Apache Axis 1.x allows unauthenticated remote class instantiation; unsupported as end-of-life.
Stories per day · 30 days
2 RSS
5 stories, newest first · one card per story
Stories tagged #soap
NETGEAR RAX120 V1.2.5.18 SOAP InstallApp command injection disclosed
An authenticated request can reach OS command execution in the router's root-configured web stack.
CVE-2026-88920: Apache WSS4J: SAML Sender-Vouches Authentication Bypass
Apache WSS4J DOM flaw lets attackers forge authenticated SOAP messages via SAML Sender-Vouches (CVE-2026-88920).
[0day-rubbish] CaptureBites MetaServer Anonymous WCF SOAP workflow leading to RunPrograms code execution (9.8)
Unauthenticated attackers can trigger CaptureBites MetaServer RunPrograms execution as SYSTEM through an anonymous WCF SOAP workflow.
[0day-rubbish] Jitterbit Agent 12.8.1.6 (Docker jitterbit/agent:12.8.1.6) Unauthenticated SOAP with hard-coded credentials leading to OS command execution (9.8)
Jitterbit Agent 12.8.1.6's Docker image exposes unauthenticated SOAP with hard-coded credentials, leading to OS command execution (CVSS 9.8).